Who needs Cyber Essentials and secure Microsoft 365, by industry
Most Cyber Essentials certificates are sought because a client, a contract, a funder or a regulator asked for one. Pick your sector to see what you are usually asked for, whether it is required, and what it costs.
Pick your sector
Law firms
Cyber EssentialsCyber Essentials PlusRequired
Required on Legal Aid Agency contracts in force from 1 October 2025, with Plus recommended. The Law Society recommends it for every firm.
Cyber Essentialsfrom £995a year
Accountants and financial services
Cyber EssentialsCyber Essentials PlusTender-driven
Not required by the accountants' institute (ICAEW) or the regulator (FCA). ICAEW says it features in many procurement processes, and some clients ask for Plus.
Cyber Essentialsfrom £995a year
Healthcare and care
Cyber EssentialsCyber Essentials PlusRequired
Every organisation with access to NHS patient information completes the NHS data security toolkit (DSPT) each year. Plus is optional but exempts some toolkit questions. Makers of digital health products need Cyber Essentials to pass DTAC, the NHS England checklist that care providers use before buying.
Cyber Essentialsfrom £995a year
Charities
Cyber EssentialsRecommended
Suggested by the Charity Commission for medium and large charities. Required where a funder or a public contract asks for it.
Cyber Essentialsfrom £995a year
Construction and engineering
Cyber Essentials PlusTender-driven
Plus or ISO 27001 lets you skip seven cyber security questions at prequalification under Build UK's Common Assessment Standard. Required where a public buyer applies procurement rule PPN 014, or on Ministry of Defence contracts.
Cyber Essentials Plusfrom £2,495a year
Defence suppliers
DCC Level 0Cyber EssentialsRequired
Cyber Essentials is required by contract at every level under the Ministry of Defence's cyber conditions (DEFCON 658 and DEF STAN 05-138). The MoD has asked all industry partners to reach DCC Level 0 by 31 December 2026.
DCC Level 0from £1,445a year, on a 3-year term
Public sector suppliers
Cyber EssentialsCyber Essentials PlusRequired
Required where procurement rule PPN 014 applies: central government and NHS contracts with the risk features it lists. Plus is the buyer's choice for higher risk. Councils may follow it.
Cyber Essentialsfrom £995a year
Education suppliers, schools and colleges
Cyber EssentialsRequired
Required for colleges under their funding agreement. Optional for schools, which the Department for Education's standard tells to ask their IT suppliers whether they hold it.
Cyber Essentialsfrom £995a year
Prices are on our price list and exclude VAT. The examples on each page are examples, not quotes. Licence prices are Microsoft's UK list prices, shown as a monthly equivalent of the annual subscription.
Where each rule comes from
| Sector | Usually asked for | Status | Source | Page |
|---|---|---|---|---|
| Law firms | Cyber Essentials, with Plus recommended | Required: on Legal Aid Agency contracts in force from 1 October 2025; recommended for every firm by the Law Society | LAA Data Security Requirements v5 | Law firms page |
| Accountants and financial services | Cyber Essentials or Plus | Tender-driven: not required by ICAEW or the FCA; ICAEW says it features in many procurement processes, and some clients ask for Plus | ICAEW cyber security guide | Accountants and financial services page |
| Healthcare and care | The DSPT every year; Cyber Essentials Plus is optional; Cyber Essentials for DTAC | Required: the DSPT for every organisation with access to NHS patient information, and Cyber Essentials to pass DTAC; Plus is optional and exempts some DSPT questions | DSPT overview | Healthcare and care page |
| Charities | Cyber Essentials | Recommended: suggested by the Charity Commission for medium and large charities; required where a funder or a public contract asks for it | Protect your charity from cyber crime (Charity Commission) | Charities page |
| Construction and engineering | Cyber Essentials Plus (or ISO 27001) | Tender-driven: earns the Common Assessment Standard shortcut at prequalification (advisory question 161); required where a buyer applies PPN 014 or an MoD contract | Build UK Common Assessment Standard | Construction and engineering page |
| Defence suppliers | Cyber Essentials at every level, Plus at Levels 2 and 3, and DCC Level 0 asked for by 31 December 2026 | Required: by contract under DEFCON 658 and DEF STAN 05-138, for MoD suppliers and their subcontractors; DCC Level 0 is asked for by the MoD and expected to become a baseline | DEF STAN 05-138 Issue 4 | On this page, and DCC certification |
| Public sector suppliers | Cyber Essentials or Plus | Required: where PPN 014 applies: central government and NHS contracts with the risk features it lists, with Plus at the buyer's choice for higher risk; councils may follow it | PPN 014 | Public sector suppliers page |
| Education suppliers, schools and colleges | Cyber Essentials | Required: for colleges under the funding agreement; optional for schools, which the DfE standard tells to ask their IT suppliers whether they hold it | DfE cyber security standard | Education suppliers, schools and colleges page |
Defence suppliers
If you sell to the Ministry of Defence (MoD), or to a company that does, the contract can pass cyber security controls down to you. The contract condition is DEFCON 658, and the standard it points to is DEF STAN 05-138. Every MoD Cyber Risk Profile level requires Cyber Essentials. The MoD has also asked all industry partners to reach Defence Cyber Certification (DCC) Level 0 by 31 December 2026.
| What | Status | Who it reaches | Source |
|---|---|---|---|
| Meet the DEF STAN 05-138 controls for your contract's Cyber Risk Profile | Required by contract | Suppliers on MoD contracts that carry DEFCON 658, and their subcontractors | MoD Cyber Security Model guidance |
| Cyber Essentials | Required at every level, 0 to 3 | As above | DEF STAN 05-138 Issue 4, control 0001 |
| Cyber Essentials Plus | Required at Levels 2 and 3 only | As above | DEF STAN 05-138 Issue 4, control 0002 |
| DCC Level 0 by 31 December 2026 | Asked for by the MoD. Not yet a term in every contract | All industry partners | Defence Digital blog, 8 May 2026 |
| Passing the requirements down the chain | Required. Suppliers are responsible for flow down | Primes and every tier below | MoD Cyber Security Model guidance |
The MoD guidance is plain: "Suppliers are contractually required to meet Def Stan 05-138 controls". Your level comes from a risk assessment of the contract, not from your own view of your risk. The MoD buyer, or the prime above you, gives you a Cyber Risk Profile and a Risk Assessment Reference. You then complete a Supplier Assurance Questionnaire, and if you fall short you submit a Cyber Improvement Plan that says when you will comply.
DCC is independent proof that you meet those controls. Since 30 March 2026, Industry Security Notice 2026/02 has told buyers to accept a valid DCC certificate at the required level or higher. Is it mandatory? Not yet for everyone. The MoD's updated text for the standard says the MoD "may require certification as part of procurement", and adds: "It is anticipated that Level 0 certification will become a baseline requirement for Defence suppliers" (ISN 2026/01). Level 0 has three controls, which apply at every level: Cyber Essentials (control 0001), UK GDPR compliance (control 2314) and resilient networks and systems (control 2500).
If your business runs email, files and Teams in Microsoft 365, it is part of this. Under Cyber Essentials, cloud services that hold your data or services "must be in scope", and version 3.3 of the requirements says "authentication to cloud services must always use MFA" (NCSC). Where your business-critical operations rely on a third-party service, you must show the controls are still met (ISN 2026/01), so your Microsoft 365 settings, and every laptop that opens it, are part of your evidence. Our DCC certification page has the prices by team size, and our DCC guide explains the levels and the 3-year cycle.
How we deliver it
Keep the controls in place all year. Our Managed plan (£35 per user a month) patches and monitors computers with NinjaOne, adds Huntress Managed EDR watched by a 24/7 security team, and sets up Microsoft Defender for Business. It keeps MFA and other security settings in place, backs up Microsoft 365 and includes unlimited remote fixes during support hours. Secure (£55) adds 24/7 monitoring of Microsoft 365 sign-ins, staff phishing tests and a monthly report mapped to Cyber Essentials controls.
Get certified. Our DCC Level 0 and Level 1 packages include Cyber Essentials, renewed each year, on a 3-year term. DCC Level 0 with Cyber Essentials is £1,445 a year for 1 to 9 people, or £1,195 on Managed or Secure, and Level 1 starts at £5,595. If you already hold Cyber Essentials, Level 0 on its own is £995 for 1 to 9 people, one payment for the 3 years. Every band is on the DCC certification page.
Level 1 and above. Level 1 has 101 controls. Work on controls you don't yet have is £95 an hour on our Essentials plan or £125 an hour without a plan, or we fix a price once we've checked your setup. On Managed and Secure, remote fixes to Microsoft 365 and your managed computers are already included. Certification is decided by the certification body. We suggest starting with a DCC Level 1 gap assessment, £2,950 fixed for up to 49 people. Levels 2 and 3 need Cyber Essentials Plus, and we quote them.
We prepare you and support the submission.
Example at our prices
Example only, not a quote
A 15-person engineering subcontractor on Microsoft 365 Business Premium, on our Managed plan, getting DCC Level 0.
- Licences: 15 × £24.60 = £369 a month
- Managed support: 15 × £35 = £525 a month
- Together: £369 + £525 = £894 a month, or £10,728 a year
- DCC Level 0 with Cyber Essentials, support-client price for 10 to 19 people: £1,545 a year on a 3-year term
- Year one: £10,728 + £1,545 = £12,273, excluding VAT
Without a support plan, the same DCC Level 0 package is £1,945 a year. The support route saves £400 a year, or £1,200 over the 3-year term (£5,835 against £4,635). Onboarding is one month's support fee, £525, waived on a 12-month agreement.
Common questions
Is DCC Level 0 mandatory by 31 December 2026?
Not for every supplier yet. The MoD has asked all industry partners to reach Level 0 by that date. The legal duty comes through contracts: where DEFCON 658 applies, you must meet the DEF STAN 05-138 controls, and Cyber Essentials is one of them at every level. The MoD expects Level 0 to become a baseline requirement.
We are a subcontractor. Does this reach us?
It can. The MoD's notice on the current Cyber Security Model applies to suppliers on MoD contracts or subcontracts thereof. The prime runs a risk assessment for your subcontract and passes you a reference. Ask your customer for it.
Do we need Cyber Essentials Plus?
Only if your contract's Cyber Risk Profile is Level 2 or 3. Levels 0 and 1 need Cyber Essentials. The MoD has asked that higher levels lower in the supply chain be scheduled for delivery after 31 December 2026.